agenttesla | ef176faa1d186e67f9ab559b32c35dcfe874bef49156ebcd414d5c032ec2f55a

Analysis

max time kernel
178s
max time network
57s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:42

Target

tmp.exe
Size

753KB
MD5

751532ac5635d8c77a474df541c780d9
SHA1

d7a962a32cafae1e791d2f896d0c9bb6ae0384d0
SHA256

ef176faa1d186e67f9ab559b32c35dcfe874bef49156ebcd414d5c032ec2f55a
SHA512

4a32296e5b02d8a6cf5c839ec0425231bde4d4d51dc92030c4fd658c6da11cc49521523a9547e40d658146b0a703ac04d12d2df2f78f25c2863d28a7a8fcb474
SSDEEP

12288:939riVwf3iJ+HN3TFfIKXKH0oKnkishvwWqWogZWhwOANLw/y/9Zu/E9jtgmdbtb:9Nriy/fTFfyRIA2R59Ntjk

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot1900392974:AAEB_yGGlWksNcNC4Dg08OgUSlmDON2w098/sendDocument

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/328-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/328-64-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/328-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/328-66-0x000000000043772E-mapping.dmp	family_agenttesla
behavioral1/memory/328-70-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/328-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

tmp.exe

description pid process target process

PID 1996 set thread context of 328 1996 tmp.exe RegAsm.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

tmp.exeRegAsm.exe

pid process

1996 tmp.exe
1996 tmp.exe
328 RegAsm.exe
328 RegAsm.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

tmp.exeRegAsm.exe

description pid process

Token: SeDebugPrivilege 1996 tmp.exe
Token: SeDebugPrivilege 328 RegAsm.exe

description	pid	process	target process
PID 1996 set thread context of 328	1996	tmp.exe	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	1996	tmp.exe
Token: SeDebugPrivilege	328	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

tmp.exe

description	pid	process	target process
PID 1996 wrote to memory of 328	1996	tmp.exe	RegAsm.exe
PID 1996 wrote to memory of 328	1996	tmp.exe	RegAsm.exe
PID 1996 wrote to memory of 328	1996	tmp.exe	RegAsm.exe
PID 1996 wrote to memory of 328	1996	tmp.exe	RegAsm.exe
PID 1996 wrote to memory of 328	1996	tmp.exe	RegAsm.exe
PID 1996 wrote to memory of 328	1996	tmp.exe	RegAsm.exe
PID 1996 wrote to memory of 328	1996	tmp.exe	RegAsm.exe
PID 1996 wrote to memory of 328	1996	tmp.exe	RegAsm.exe
PID 1996 wrote to memory of 328	1996	tmp.exe	RegAsm.exe
PID 1996 wrote to memory of 328	1996	tmp.exe	RegAsm.exe
PID 1996 wrote to memory of 328	1996	tmp.exe	RegAsm.exe
PID 1996 wrote to memory of 328	1996	tmp.exe	RegAsm.exe

memory/328-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/328-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/328-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/328-70-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/328-66-0x000000000043772E-mapping.dmp

Download
memory/328-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/328-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/328-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1996-55-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download
memory/1996-54-0x00000000001D0000-0x0000000000292000-memory.dmp

Filesize
776KB

Download
memory/1996-59-0x00000000007C0000-0x00000000007C6000-memory.dmp

Filesize
24KB

Download
memory/1996-58-0x0000000002150000-0x000000000216A000-memory.dmp

Filesize
104KB

Download
memory/1996-57-0x00000000007A0000-0x00000000007B8000-memory.dmp

Filesize
96KB

Download
memory/1996-56-0x00000000003B0000-0x00000000003E0000-memory.dmp

Filesize
192KB

Download